A new Linux botnet called Kairos is spreading rapidly by exploiting a basic but critical misconfiguration: Telnet services configured to accept the root user without any password. Once an attacker gains access this way, they deploy a lightweight Go-based malware that turns affected devices into nodes for distributed denial-of-service (DDoS) attacks. The campaign underscores how simple oversights continue to open doors for attackers.
How Kairos Infects Devices
The infection chain starts with attackers targeting devices that expose Telnet with root access allowed and no password set. After logging in, they execute a brief script:
- They run
uname -mto determine the system architecture (for example, x86_64) to ensure the payload is compatible. - They move into the
/tmpdirectory, remove artifacts from prior infections, and fetch the malware using tools like wget, curl, or TFTP—adapting for embedded systems lacking full toolsets. The downloaded binary is marked executable and launched.
Analysts identified three Kairos samples exhibiting nearly identical behavior. Differences were only seen in the hardcoded command-and-control (C2) server addresses and in minor compiler patch versions (Go 1.27.0 vs. 1.27.1), suggesting the operator rebuilds the same core code for each C2. These findings were based on honeypot captures.
Botnet Behavior and Weaknesses
Once running, Kairos connects to its hardcoded C2 and sends a plain-text registration message (“REGISTER linux amd64 hold (to initiate traffic floods), !ka (to pause all attacks), and !ku (to resume).
Kairos launches attacks using a large number of real TCP connections rather than raw packet bursts. Each CPU core runs dozens to hundreds of worker threads—at least 256 total—and keeps connections open by sending minimal data (e.g., a space every few seconds). When a target refuses connections, workers retry quickly, causing what’s known as a “connect storm,” overwhelming server connection limits.
The malware lacks several features common in more complex threats: it does not persist across reboots, cannot spread autonomously, has no remote command execution beyond three simple commands, and includes no anti-analysis capabilities. The attacker attempts basic cloaking by renaming its process to mimic Linux kernel workers, but system tools like ps and inspection of the /proc filesystem still expose its real identity.
Detection, Indicators, and Defense
Security analysts provided several indicators of compromise (IoCs) such as specific IPv4 addresses for payload hosting and command servers, plus SHA-256 hashes of binaries compiled for architectures like AMD64, ARM, MIPS, and 386. Monitoring for those IPs or hashes can help with detection.
Defensive recommendations include disabling Telnet services, removing any root login without password, and blocking outbound traffic to known C2 IPs/ports (notably TCP ports 8080 and 9999). Additional detection strategies involve watching for the plain-text “REGISTER linux” beacon in network logs, deploying published YARA rules specific to Kairos, and alerting on processes with kernel-like names managing unusually large numbers of outbound connections.
Kairos isn’t the first threat to exploit weak remote access; previous botnets including Mirai and VOIP-specific campaigns have relied heavily on default Telnet credentials. What stands out for Kairos is its simplicity and rapid adaptive builds for each C2, yet its lack of stealth or persistence means some traditional security tools and practices remain effective against it.
Analytical Take: Kairos is a stark reminder that security isn’t just about defending against zero-day exploits but getting the basics right. A Telnet server with root/no-password might seem trivial in 2026, but it’s still opening the door wide for calls to the C2s. As infrastructure matures and IoT tooling improves, bots like Kairos highlight how legacy protocols and basic misconfigurations are low-hanging fruit for attackers. Organizations should double down on foundational security—closing old ports like Telnet, enforcing strong credential policies, and monitoring outbound connections. What to watch next: whether variants of Kairos evolve with persistence mechanisms, stealthy encryption, or broadened command capabilities, and how defenders update detection signatures in response.
